Malware is not allowing me to use internet and shutting down some of my processes

Welcome to Major Geeks!

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

• If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.
  • TDSSserv Non-Plug & Play Driver Disable
• If something does not run, write down the info to explain to us later but keep on going.
• Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide

Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode. You can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME ) onto another PC and burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes, you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. To avoid additional delay in getting a response, it is advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!!!
4. Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

 

Jmalch

Please transfer all of the tools to your harddrive as requested. Make sure that you update the anti-spyware scanners' definitions before running them.

Attach all of the requested logs.

• SASlog.txt log from SuperAntiSpyware.
• Malwarebytes Anti-Malware log
• ComboFix.txt (normally C:\ComboFix.txt)
• MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.

dr.m

 

Hello, Jmalch

I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Our queue is working the oldest threads first.

Thanks for your patience.
dr.m

 

Hello, Jmalch


The below fixes are specific to your problem and should only be used for issue(s) on this machine. Also, please do not install any other software while we are still working with you unless instructed. Once we have given you the all clean and final instructions you will be free to install what you want.

*First you need to disable Spybot's Teatimer as requested in the READ & RUN ME. See this: How to disable Spybot's TeaTimer

After rebooting from disabling Teatimer, continue with the below.

*You need to run MSconfig and put your PC into normal startup mode as requested in step 1 of the READ & RUN ME.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed

Step 2:
Now we need to use ComboFix to remove some malware.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. *Remember to re-start them before coming back online.
• Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
  If it asks you to overide the previous file with the same name, click YES.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Step 3:
Open Ccleaner - select "Cleaner" > "Run Cleaner" <---use this ONLY

Step 4:
Now install the latest Sun Java Runtime Environment

Step 5:
Your Malwarebytes Anti-Malware log shows the definitions are outdated. Run MBAM again - after you have updated it.

Step 6:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

Then attach the below logs to your next reply:

• C:\MGlogs.zip
• C:\combofix.txt
• a new MBAM log

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!

dr.m

 

Is this still occurring? The reason I ask is that since you had no internet connection for awhile, it is possible you are having a lot of activity with programs (including Windows) getting automatic updates or at least checking for updates.

Now uninstall Norton Security Scan

Now please run the below then reboot. After reboot run it one more time.

Norton Removal Tool (SymNRT)

Now I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save executable program files here and defintely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here like you are doing.



Now we need to use ComboFix again. However first let's make sure you have the current version. Delete the combofix.exe file that is currently on your Desktop. Then download and save to your Desktop a new version from here: combofix.exe

• If ComboFix.exe is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Sounds to me like network use should be high when you are downloading.

You will have to be much more specific as to what processed you are referring to and when this happens.

Your logs are clean, but it does not look like you ran the Norton Removal Tool since I still see things from Norton/Symantec installed and running. Did you decide to keep all of the Norton software (which could also be the cause of high network use)? If so, we now need to cleanup leftovers from AVG which you appear to have been changing on your own. You are only supposed to be doing what we ask you to do once you start the cleaning process. If you are making changes to your PC on your own you make things more difficult for us which makes it take longer to resolve problems.

At this point the best thing you could do would be to uninstall ALL of Norton and all of AVG and then reboot and attach a new log from MGtools so we can make sure everything was removed properly. Having multiple antivirus programs installed can cause many problems. Note that there is also a removal tool for AVG which may help get rid of some of the left overs. Try running the 32 bit version of the tool from the below

AVG Remover